Information

Security
Classical Encryption
Techniques
 Symmetric Encryption
• Also referred to as conventional encryption or
single-key encryption
• Was the only type of encryption in use prior to
the development of public-key encryption in
the 1970s
• Remains by far the most widely used of the
two types of encryption
 Basic Terminology
• Plaintext
• The original message • Cryptographic system or
cipher
• Ciphertext • Schemes used for
• The coded message encryption
• Enciphering or encryption • Cryptanalysis
• Process of converting from
• Techniques used for
plaintext to ciphertext
deciphering a message
• Deciphering or decryption without any knowledge
• Restoring the plaintext from of the enciphering details
the ciphertext
• Cryptology
• Cryptography • Areas of cryptography
• Study of encryption
and cryptanalysis
 Simplified Model of
Symmetric Encryption
Model of Symmetric
Cryptosystem
 Cryptographic Systems
• Characterized along three independent dimensions:

The type of operations

The number of keys The way in which the
used for transforming
used plaintext is processed
plaintext to ciphertext

Symmetric,
single-key, secret-
Substitution Block cipher
key, conventional
encryption

Asymmetric, two-
Transposition key, or public-key Stream cipher
encryption
 Cryptanalysis and
Brute-Force Attack
Cryptanalysis Brute-force attack
• Attack relies on the • Attacker tries every
nature of the possible key on a
algorithm plus some piece of ciphertext
knowledge of the until an intelligible
general translation into
characteristics of the plaintext is obtained
plaintext • On average, half of
• Attack exploits the
all possible keys
characteristics of the must be tried to
algorithm to attempt achieve success
to deduce a specific
plaintext or to
deduce the key being
used
Encryption Scheme Security
• Unconditionally secure
• No matter how much time an opponent has, it is
impossible for him or her to decrypt the
ciphertext simply because the required
information is not there

• Computationally secure
• The cost of breaking the cipher exceeds the value
of the encrypted information
• The time required to break the cipher exceeds
the useful lifetime of the information
 Brute-Force Attack
Involves trying every possible key until an intelligible
translation of the ciphertext into plaintext is
obtained

On average, half of all possible keys must be tried to

achieve success

To supplement the brute-force approach, some

degree of knowledge about the expected plaintext
is needed, and some means of automatically
distinguishing plaintext from garble is also needed
 Substitution Technique
• Is one in which the letters of plaintext are
replaced by other letters or by numbers or
symbols
• If the plaintext is viewed as a sequence of bits,
then substitution involves replacing plaintext
bit patterns with ciphertext bit patterns
 Caesar Cipher
• Simplest and earliest known use of a substitution
cipher
• Used by Julius Caesar

• Involves replacing each letter of the alphabet with the

letter standing three places further down the alphabet
• Alphabet is wrapped around so that the letter
following Z is A

plain: meet me after the toga party

cipher: PHHW PH DIWHU WKH WRJD SDUWB

 Caesar Cipher Algorithm
• Can define transformation as:
abcdefghijklmnopqrstuvwxyz
D EF G H IJK LMN O PQ RSTUVWXYZABC

• Mathematically give each letter a number

abcdefghij k l m n o p q r s t u v w x y z
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

• Algorithm can be expressed as:

c = E(3, p) = (p + 3) mod (26)

• A shift may be of any amount, so that the general Caesar algorithm is:

C = E(k , p ) = (p + k ) mod 26
• Where k takes on a value in the range 1 to 25; the decryption
algorithm is simply:

p = D(k , C ) = (C - k ) mod 26
 Brute-Force
Cryptanalysis of
Caesar Cipher

(This chart can be found on

page 55 in the textbook)
Sample of Compressed Text
 Monoalphabetic Cipher
• Permutation
• Of a finite set of elements S is an ordered sequence of
all the elements of S , with each element appearing
exactly once

• If the “cipher” line can be any permutation of

the 26 alphabetic characters, then there are 26!
• Approach is referred to as a monoalphabetic
substitution cipher because a single cipher alphabet is
used per message
 Monoalphabetic Ciphers
• Easy to break because they reflect the frequency
data of the original alphabet
• Countermeasure is to provide multiple substitutes
(homophones) for a single letter
• Digram
• Two-letter combination
• Most common is th

• Trigram
• Three-letter combination
• Most frequent is the
 Playfair Cipher
• Best-known multiple-letter encryption cipher

• Treats digrams in the plaintext as single units and

translates these units into ciphertext digrams
• Based on the use of a 5 x 5 matrix of letters
constructed using a keyword
• Invented by British scientist Sir Charles Wheatstone
in 1854
• Used as the standard field system by the British
Army in World War I and the U.S. Army and other
Allied forces during World War II
 Playfair Key Matrix
• Fill in letters of keyword (minus duplicates)
from left to right and from top to bottom,
then fill in the remainder of the matrix with the
remaining letters in alphabetic order
• Using the keyword MONARCHY:
M O N A R
C H Y B D
E F G I/J K
L P Q S T
U V W X Z
 Hill Cipher
• Developed by the mathematician Lester Hill in
1929
• Strength is that it completely hides single-letter
frequencies
• The use of a larger matrix hides more frequency
information
• A 3 x 3 Hill cipher hides not only single-letter but
also two-letter frequency information

• Strong against a ciphertext-only attack but

easily broken with a known plaintext attack
 Polyalphabetic Ciphers
• Polyalphabetic substitution cipher
• Improves on the simple monoalphabetic
technique by using different monoalphabetic
substitutions as one proceeds through the
plaintext message

All these techniques

have the following
•A
•A
features in common:
set of related monoalphabetic substitution rules is used
key determines which particular rule is chosen for a given transformation
 Vigenère Cipher
• Best known and one of the simplest
polyalphabetic substitution ciphers
• In this scheme the set of related
monoalphabetic substitution rules consists of
the 26 Caesar ciphers with shifts of 0 through
25
• Each cipher is denoted by a key letter which is
the ciphertext letter that substitutes for the
plaintext letter a
Example of Vigenère Cipher
• To encrypt a message, a key is needed that is
as long as the message
• Usually, the key is a repeating keyword

• For example, if the keyword is deceptive, the

message “we are discovered save yourself” is
encrypted as:

key: deceptivedeceptivedeceptive
plaintext: wearediscoveredsaveyourself
ciphertext: ZICVTWQNGRZGVTWAVZHCQYGLMGJ
Vigenère Autokey System
• A keyword is concatenated with the plaintext
itself to provide a running key
• Example:
key: deceptivewearediscoveredsav
plaintext: wearediscoveredsaveyourself
ciphertext: ZICVTWQNGKZEIIGASXSTSLVVWLA
• Even this scheme is vulnerable to cryptanalysis
• Because the key and the plaintext share the same
frequency distribution of letters, a statistical
technique can be applied
Vernam Cipher
 One-Time Pad
• Improvement to Vernam cipher proposed by an Army Signal Corp
officer, Joseph Mauborgne
• Use a random key that is as long as the message so that the key
need not be repeated
• Key is used to encrypt and decrypt a single message and then is
discarded
• Each new message requires a new key of the same length as the
new message
• Scheme is unbreakable
• Produces random output that bears no statistical relationship to
the plaintext
• Because the ciphertext contains no information whatsoever about
the plaintext, there is simply no way to break the code
 Difficulties
• The one-time pad offers complete security but, in practice, has
two fundamental difficulties:
• There is the practical problem of making large quantities of
random keys
• Any heavily used system might require millions of random
characters on a regular basis
• Mammoth key distribution problem
• For every message to be sent, a key of equal length is needed by
both sender and receiver

• Because of these difficulties, the one-time pad is of limited utility

• Useful primarily for low-bandwidth channels requiring very high
security

• The one-time pad is the only cryptosystem that exhibits perfect

secrecy (see Appendix F)
 Rail Fence Cipher
• Simplest transposition cipher

• Plaintext is written down as a sequence of

diagonals and then read off as a sequence of rows
• To encipher the message “meet me after the toga
party” with a rail fence of depth 2, we would write:
mematrhtgpry
etefeteoaat
Encrypted message is:
MEMATRHTGPRYETEFETEOAAT
Row Transposition Cipher
• Is a more complex transposition

• Write the message in a rectangle, row by row, and read

the message off, column by column, but permute the
order of the columns
• The order of the columns then becomes the key to the
algorithm
Key: 4312 5 67
Plaintext: atta c kp
ostpone
dunt i l t
w o a mx y z
Ciphertext: TTNAAPTMTSUOAODWCOIXKNLYPETZ
Rotor Machines
Steganography
 • Character marking
• Selected letters of printed or
typewritten text are over-written in
Other pencil
• The marks are ordinarily not visible
Steganography unless the paper is held at an angle
to bright light
Techniques • Invisible ink
• A number of substances can be
used for writing but leave no visible
trace until heat or some chemical is
applied to the paper
• Pin punctures
• Small pin punctures on selected
letters are ordinarily not visible
unless the paper is held up in front
of a light
• Typewriter correction ribbon
• Used between lines typed with a
black ribbon, the results of typing
with the correction tape are visible
only under a strong light
 Summary
• Symmetric Cipher • Substitution
Model techniques
• Cryptography • Caesar cipher
• Cryptanalysis and • Monoalphabetic
Brute-Force Attack ciphers
• Playfair cipher
• Transposition
• Hill cipher
techniques
• Polyalphabetic ciphers
• Rotor machines • One-time pad

• Steganography
 Assignment-1
Students must work individual to prepare a poster on a topic in
network security. Students must choose a topic in
networking (examples from past years include Voice over IP, Vehicular
Networks, text messaging, etc.), clearly state
a security property that is important to that application, and either (a)
present a protocol that guarantees that
security property, or (b) present an attack on the application that
breaks the security property.
Protocols and attacks need not be original; students are welcome to
present attacks or protocols that were
published at technical conferences or that appear in Internet
Standards.